Episode 191

Overview

This week saw the unexpected release of Ubuntu 20.04.6 so we go into the detail behind that, plus we talk Everything Open and we cover security updates including Emacs, LibreCAD, Python, vim and more.

This week in Ubuntu Security Updates

82 unique CVEs addressed

[USN-5955-1] Emacs vulnerability [00:50]

• 1 CVEs addressed in Xenial ESM (16.04 ESM)
  • CVE-2022-48339
• htmlfontify package would try and validate whether a given file is text by calling file on it - but would fail to escape the filename - so if a user could be tricked into running htmlfontify-copy-and-link-dir on a crafted directory, could get code execution in the context of emacs
• Unlikely to be an issue in practice, also there doesn’t appear to be any users of this function on github (other than references to the documentation for it)

[USN-5956-1, USN-5956-2] PHPMailer vulnerabilities [02:03]

• 7 CVEs addressed in Xenial ESM (16.04 ESM), Bionic (18.04 LTS), Focal (20.04 LTS), Jammy (22.04 LTS)
  • CVE-2021-3603
  • CVE-2020-13625
  • CVE-2018-19296
  • CVE-2017-5223
  • CVE-2017-11503
  • CVE-2016-10045
  • CVE-2016-10033
• email sending library for PHP
• similarly, possible RCE since could possibly inject commands that would be passed to the shell when executing the underlying mail command - original patch didn’t fix properly so second CVE was issued for the fix

[USN-5957-1] LibreCAD vulnerabilities [02:58]

• 7 CVEs addressed in Xenial ESM (16.04 ESM), Bionic (18.04 LTS), Focal (20.04 LTS)
  • CVE-2021-45343
  • CVE-2021-45342
  • CVE-2021-45341
  • CVE-2021-21900
  • CVE-2021-21899
  • CVE-2021-21898
  • CVE-2018-19105
• Various memory corruption issues when parsing DXF, DWG, DRW or JWW files
  • OOB writes, UAFs, NULL ptr deref - RCE / DoS

[USN-5855-2] ImageMagick vulnerabilities [03:37]

• 2 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS), Kinetic (22.10)
  • CVE-2022-44268
  • CVE-2022-44267

[USN-5958-1] FFmpeg vulnerabilities [03:45]

• 4 CVEs addressed in Xenial ESM (16.04 ESM), Bionic (18.04 LTS), Focal (20.04 LTS), Jammy (22.04 LTS), Kinetic (22.10)
  • CVE-2022-3965
  • CVE-2022-3964
  • CVE-2022-3341
  • CVE-2022-3109
• 2 NULL ptr derefs and 2 OOB reads -> DoS

[USN-5954-1] Firefox vulnerabilities [03:59]

• 9 CVEs addressed in Bionic (18.04 LTS), Focal (20.04 LTS)
  • CVE-2023-28161
  • CVE-2023-28164
  • CVE-2023-28160
  • CVE-2023-25751
  • CVE-2023-28177
  • CVE-2023-28176
  • CVE-2023-28162
  • CVE-2023-25752
  • CVE-2023-25750
• 111.0
  • usual mix of issues for web engines (DoS, info leak across domains, RCE) if visited a malicious website
  • memory corruption, plus a few logic issues that could be used to either cause firefox to leak local information back to the web server or spoof parts of the UI etc

[USN-5961-1] abcm2ps vulnerabilities

• 6 CVEs addressed in Xenial ESM (16.04 ESM), Bionic (18.04 LTS), Focal (20.04 LTS), Jammy (22.04 LTS)
  • CVE-2021-32436
  • CVE-2021-32435
  • CVE-2021-32434
  • CVE-2019-1010069
  • CVE-2018-10771
  • CVE-2018-10753

[USN-5962-1] Linux kernel (Intel IoTG) vulnerabilities [04:47]

• 18 CVEs addressed in Jammy (22.04 LTS)
  • CVE-2023-26605
  • CVE-2023-0468
  • CVE-2022-47521
  • CVE-2022-47520
  • CVE-2022-47519
  • CVE-2022-47518
  • CVE-2022-45869
  • CVE-2022-4379
  • CVE-2022-42329
  • CVE-2022-42328
  • CVE-2022-4139
  • CVE-2022-3545
  • CVE-2022-3521
  • CVE-2022-3435
  • CVE-2022-3344
  • CVE-2022-3169
  • CVE-2023-0179
  • CVE-2023-0461
• two high priority issues
  • netfilter mishandling of vlan headers - OOB write -> crash / RCE
  • UAF in upper-level protocol subsystem - can be triggered by local user - similarly, crash / RCE

[USN-5959-1] Kerberos vulnerabilities [05:32]

• 2 CVEs addressed in Bionic (18.04 LTS), Focal (20.04 LTS)
  • CVE-2021-37750
  • CVE-2021-36222
• NULL ptr derefs -> crash in kerberos daemon -> DoS

[USN-5960-1] Python vulnerability [05:51]

• 1 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic (18.04 LTS), Focal (20.04 LTS), Jammy (22.04 LTS), Kinetic (22.10)
  • CVE-2023-24329
• possibly to bypass blocklists in urllib.parse() simply by prefixing the URL with a space - blocklisting is not part of upstream functionality but often would be implemented in application / library logic by first using urlparse() to parse the given URL - if prefixed with a space then can get urlparse() to fail to return the correct scheme/hostname - can workaround simply by first calling strip() on URL - apparently upstream still discussing whether the current fix is sufficient so watch this space

[USN-5963-1] Vim vulnerabilities [07:14]

• 9 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic (18.04 LTS), Focal (20.04 LTS), Jammy (22.04 LTS), Kinetic (22.10)
  • CVE-2023-1264
  • CVE-2023-1175
  • CVE-2023-1170
  • CVE-2023-0051
  • CVE-2023-0433
  • CVE-2023-0288
  • CVE-2023-0054
  • CVE-2023-0049
  • CVE-2022-47024
• moar vim vulns from bug-bounty - all found via fuzzing of vim - all memory corruption vulns -> DoS / RCE

[USN-5964-1] curl vulnerabilities [07:41]

• 5 CVEs addressed in Bionic (18.04 LTS), Focal (20.04 LTS), Jammy (22.04 LTS), Kinetic (22.10)
  • CVE-2023-27538
  • CVE-2023-27536
  • CVE-2023-27535
  • CVE-2023-27534
  • CVE-2023-27533
• various connection reuse issues - eg. would reuse an SSH connection even if caller had changed an SSH option - similar for FTP.
• mishandling of ~ in SFTP could then allow access to unintended files (would expand even if not the first part of the path)

[USN-5806-3] Ruby vulnerability [08:43]

• 1 CVEs addressed in Focal (20.04 LTS)
  • CVE-2021-33621

[USN-5965-1] TigerVNC vulnerability [08:53]

• 1 CVEs addressed in Focal (20.04 LTS)
  • CVE-2020-26117
• when processing a TLS certificate, would store that internally as a certificate authority - then if client connected to a different server would use that stored cert as a CA cert to validate the new server - could then allow a malicious server to impersonate other servers

[USN-5904-2] SoX regression [09:35]

• 9 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic (18.04 LTS), Focal (20.04 LTS), Jammy (22.04 LTS), Kinetic (22.10)
  • CVE-2022-31651
  • CVE-2022-31650
  • CVE-2021-40426
  • CVE-2021-3643
  • CVE-2021-23210
  • CVE-2021-23172
  • CVE-2021-23159
  • CVE-2019-13590
  • CVE-2021-33844
• Fix for one of the vulns fixed in the original update was incomplete

Goings on in Ubuntu Security Community

Ubuntu 20.04.6 LTS Released [09:49]

• https://lists.ubuntu.com/archives/ubuntu-announce/2023-March/000287.html
• https://wiki.ubuntu.com/FocalFossa/ReleaseSchedule
• Wasn’t originally planned to be released

Unlike previous point releases, 20.04.6 is a refresh of the amd64 installer media after recent key revocations, re-enabling their usage on Secure Boot enabled systems.

Many other security updates for additional high-impact bug fixes are also included, with a focus on maintaining stability and compatibility with Ubuntu 20.04 LTS.

• TL;DR - recent vulnerabilities in shim and grub meant that we revoked those old versions such that they would not boot anymore if updates had been installed - so if wanted to reinstall using the 20.04.5 media it would fail to boot. Can prove this to yourself:

cat /sys/firmware/efi/efivars/SbatLevelRT-605dab50-e046-4300-abb6-3dd810dd8b23

sbat,1,2022052400
grub,2

objdump -j .sbat -s grubx64.efi

Ubuntu Security at Everything Open 2023 [12:02]

• https://ubuntu.com/blog/everything-open-2023-in-melbourne
• https://2023.everythingopen.au/schedule/presentation/64/
• Presented about how the Ubuntu Security keeps Ubuntu secure and also gave advice on how you can improve the security of your own open source projects

Get in contact

• [email protected]
• #ubuntu-security on the Libera.Chat IRC network
• ubuntu-hardened mailing list
• Security section on discourse.ubuntu.com
• @[email protected], @ubuntu_sec on twitter